Application Serial No.: 09/578,156 
Attorney Docket No. 019287-0317293 {previously APB-01 9) 
Reply and Amendment Accompanying RCE 

Amendments to the Claims 

Please replace all prior versions and listings of claims with the following listing of claims. 
LISTING OF CLAIMS: 

1 . (Currently Amended) A system for providing service level management in a 
network, wh e r e in a sorv i co i s compos e d of network compon e nts and a stat e of th e 
Gorv i co doponds on tho stato of tho network oompononts wherein the network includes 
a plurality of network components, and wherein a service operates on a subset of the 
plurality of network components, the service having a state , the system comprising: 

multiple monitoring agents to each monitor a respective aspect of operation of 
the network, wherein each monitoring agent to d e t e ct detects one or more events 
relative to the respective aspect of operation and to generat e generates an alarm as a 
function of the one or more detected events; and 

an alarm correlation agent to rece i v e that receives tho on e or mor e alarms from 
the monitoring agents , that determines to det e rm i n e a current state of a the service 
based on alarms originating from the subset of the plurality of network components and, 
i f necessary, to i ssu e that issues one or more instructions to establish a desired state of 
the service when the current state of the service is undesirable . 

2. (Original) The system of claim 1 , wherein the monitoring agents comprise 
at least one of: 

an infrastructure monitoring agent to monitor operation of the network 
infrastructure; 

a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 
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a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 

a multicomponent monitoring agent comprising an aggregate of any of the above 
monitoring agents. 

3. (Original) The system of claim 1 , wherein the monitoring agents and 
alarm correlation agents comprise reasoning agents. 

4. (Original) The system of claim 3, wherein the reasoning agents comprise 
one or more of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

5. (Original) The system of claim 1 , comprising: 

an alarm repository to receive the one or more alarms from the monitoring 
agents, wherein the alarm correlation agent reads the alarms in the alarm repository. 

6. (Currently Amended) A system for providing service level management 
in a network, whoroin a sorv i oo i s composod of network components and a stato of tho 
serv i c e d e p e nds on a state of tho n e twork compon e nts wherein the network includes a 
plurality of network components, and wherein a service operates on a subset of the 
plurality of network components, the service having a state , the system comprising: 

a first monitoring agent to monitor that monitors a respective first aspect of 
operation of the network, the first monitoring agent to dotoct detecting one or more 
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events relative to the first aspect of operation and to gonorato generating an alarm as a 
function of the one or more detected events; 

a second monitoring agent to mon i tor that monitors a respective second aspect 
of operation of the network, different from the first aspect, the second monitoring agent 
to d e t e ct detecting one or more events relative to the second aspect of operation and to- 
gonorato generating an alarm as a function of the one or more detected events; 

an alarm repository to r e c ei v e that receives one or more alarms from each of the 
first and second monitoring agents; and 

an alarm correlation agent to read that reads the one or more alarms in the 
alarm repository, and to determin e that determines a current state of a the service from 
the read one or more alarms that originate from the subset of the plurality of network 
components . 

7 (Cancelled). 

8. (Currently Amended) The system of claim 6, wherein the alarm 
correlation agent is operative to issue one or more instructions to establish a desired 
state of the service when the current state is undesirable . 

9. (Previously Presented) The system of claim 6, wherein the first and 
second monitoring agents comprise one or more of: 

an infrastructure monitoring agent to monitor operation of the network 
infrastructure; a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 
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a response time monitoring agent to monitor a response time of a 

communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 
a multicomponent monitoring agent comprising an aggregate of any of the 

above monitoring agents. 

1 0. (Previously Presented) The system of claim 6, wherein the first and 
second monitoring agents and the alarm correlation agent comprise one or more of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

1 1 . (Currently Amended) A system for providing service level management 
in a network having at least one monitoring agent to monitor at least one aspect of 
operation and to generate an alarm as a function of one or more detected events, 
whoro i n a s e rv i c e i s compos e d of n e twork compononts and a state of th e s e rv i ce 
doponds on tho stato of tho network components, wherein the network includes a 
plurality of network components, and wherein a service operates on a subset of the 
plurality of network components, the service having a state, the system comprising: 

an alarm correlation agent to r e c ei v e that receives th e on e or mor e alarms from 
the at least one monitoring agent to determine a current state of a the service based on 
alarms originating from the subset of the plurality of network components and, 
nocossary, to i ssu e that issues one or more instructions to establish a desired state of 
the service when the current state of the service is undesirable . 

12. (Original) The system of claim 1 1 , wherein the alarm correlation agent 
comprises one or more of: 

a rule-based reasoning agent; 



30552245J 



Page 5 of 13 



Application Serial No.: 09/578,156 
Attorney Docket No. 01 9287-031 7293 (previously APB-019) 
Reply and Amendment Accompanying RCE 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; a code book reasoning agent; 

and 

a case-based reasoning agent. 

13. (Currently Amended) A method of providing service level management in 
a network, wh e r ei n a s e rv i c e is compos e d of network compononts and a stat e of th e 
service doponds on tho state of tho network components wherein the network includes 
a plurality of network components, and wherein a service operates on a subset of the 
plurality of network components, the service having a state , the method comprising: 

monitoring one or more aspects of operation of the network and detecting one or 
more events relative to of the one or more aspects of operation; 

generating an alarm for a respective aspect of network operation as a function of 
the respective detected one or more events; and 

determining a relationship between the one or more alarms and determining a 
current state of the sen/ice as a function of the relationship between the one or more 
alarms that originate from the subset of the plurality of network components . 

14. (Currently Amended) The method of claim 13, further comprising: 
generating one or more instructions to establish a desired state of the service 

when the current state of the service is undesirable . 

1 5. (Original) The method according to claim 1 3, further comprising 
monitoring at least one of: 

operation of the network infrastructure; operation of at least one computer 
system on the network; 

traffic on the network; 

operation of at least one application operating on the network; and 
operation of a trouble-ticketing process that receives reports of problems by 
users with respect to operation of the network; 
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operation of a device on the network; 

response time of a communication on the network; 

an aggregate of any of the above. 

16. (Original) The method of claim 13, wherein the generating an alarm 
comprises applying at least one of: 

rule-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
codebooks based reasoning; and 
case-based reasoning. 

17. (Original)The method of claim 13, wherein correlating the one or more 
alarms comprises applying at least one of: 

rule-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
codebooks based reasoning; and 
case-based reasoning. 

1 8. (Currently Amended) A method of providing service level management in 
a network, wh e r ei n a serv i ce i s compos e d of n e twork components and a stat e of th e 
sorv i c e depends on a stat e of th e n e twork compon e nts wherein the network includes a 
plurality of network components, and wherein a service operates on a subset of the 
plurality of network components, the service having a state , the method comprising: 

monitoring a first aspect of operation of the network and detecting one or more 
events relative to the first aspect of network operation; 

monitoring a second aspect of operation of the network, different from the first 
aspect, and detecting one or more events relative to the second aspect of network 
operation; 
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generating a first alarm as a function of the detected one or more events relative 
to the first aspect of network operation; 

generating a second alarm as a function of the detected one or more events 
relative to the second aspect of network operation; 

sending the first and second alarms to an alarm repository; 

accessing the first and second alarms from the alarm repository; and 

determining a current state of a the service as a function of the accessed first 
and second alarms that originate from the subset of the plurality of network 
components . 

19 (Cancelled). 

20. (Currently Amended) The method of claim 18, comprising: 
generating one or more instructions to establish a desired state of the service 

when the current state of the service is undesirable , wherein the one or more 
instructions control an operation of the network. 

21 . (Currently Amended) A computer program product comprising: 
a computer readable medium; 

computer program instructions on the computer-readable medium, wherein the 
computer program instructions, when executed by a computer, directs the computer to 
perform a method of providing service level management in a network, where i n a 
s e rv i c e i s compos e d of network components and a state of tho serv i ce d e p e nds on a 
stato of th e n e twork compon e nts wherein the network includes a plurality of network 
components, and wherein a service operates on a subset of the plurality of network 
components, the service having a state , the method comprising: 

monitoring one or more aspects of operation of the network and detecting one or 
more events relative to the one or more aspects of operation; 

generating an alarm for a respective aspect of network operation as a function of 
the respective detected one or more events; and 
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determining an association between the one or more alarms that originate from 
the subset of the plurality of network components and determining a current state of a 
the service as a function of the association. 

22. (Currently Amended) A system for providing service level management 
in a network, whoro i n a s e rv i c e i s composod of n e twork compononts and a stat e of th e 
florv i co depends on a stat e of th e network compon e nts wherein the network includes a 
plurality of network components, and wherein a service operates on a subset of the 
plurality of network components, the service having a state , the system comprising: 

means for monitoring one or more aspects of operation of the network and 
detecting one or more events relative to the one or more aspects of network operation; 

means for generating an alarm for a respective aspect of network operation as a 
function of the respective detected one or more events; and 

means for associating the one or more alarms that originate from the subset of 
the plurality of network components and determining a current state of the service as a 
function of the associated alarms. 

23. (Currently Amended) A system for providing service level management 
in a network, whoro i n a s e rv i c e is compos e d of network compononts and a stato of th e 
s e rv i c e d e p e nds on th e stat e of th e n e twork compon e nts wherein the network includes 
a plurality of network components, and wherein a service operates on a subset of the 
plurality of components, the service having a state , the system comprising: 

multiple monitoring agents to each monitor a respective aspect of operation of 
the network, wherein each monitoring agent to d e t e ct detects one or more events 
relative to the respective aspect of operation and generate an alarm as a function of the 
one or more detected events; 

each monitoring agent including an alarm correlation agent to roooivo that 
receives one or more alarms from the other monitoring agents for consideration in tbe- 
stop of generating the alarm as a function of the one or more detected events; and 
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each monitoring agent including a control agent to i ssuo that issues one or more 
instructions regarding the respective aspect of operation of the network in order to 
establish a desired state of a the service. 

24. (Previously Presented) The system of claim 23, wherein the monitoring 
agents comprise at least one of: 

an infrastructure monitoring agent to monitor operation of the network 
infrastructure; 

a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 

a multicomponent monitoring agent comprising an aggregate of any of the above 
monitoring agents. 

25. (Original) The system of claim 23, wherein the monitoring agents 
comprise at least one of: 

a rule-based reasoning agent; a model-based reasoning agent; 
a state-transition graph based reasoning agent; 
a code book based reasoning agent; and 
a case-based reasoning agent. 

26. (Currently Amended) A computer program product comprising: 
a computer readable medium; 
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computer program instructions on the computer readable medium, wherein the 
computer program instructions, when executed by a computer, direct the computer to 
perform a method of providing service level management in a network, whoro i n a 
serv i ce i s compos e d of n e twork compon e nts and a stat e of the serv i c e doponds on a 
stato of the n e twork compon e nts, wherein the network includes a plurality of network 
components, and wherein a service operates on a subset of the plurality of network 
components, the service having a state, the method comprising, for each of a plurality 
of agents; 

monitoring one or more aspects of the respective operation of the network and 
detecting the one or more events relative to the respective one or more aspects of 
operation; 

generating an alarm for the respective aspect of network operation as a 
function of the respective detected one or more events; and 

communicating with the other agents to access events or alarms in the 
respective operation of the other monitoring agent that originate from the subset of the 
plurality of network components , and determining an existence of an association 
between these events or alarms from other monitoring agents in the alarm generated 
for the respective aspect of network operation. 
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